What do we do after we’ve finished our investigation?
-
This guidance explains what you need to do to meet the new requirements for you to have a data protection complaints process, as set out in the Data (Use and Access) Act. Although these requirements are not in force until 19 June 2026, we think it is useful for this to be published now so that you are ready for these changes. Even before these requirements are in force, we think that what’s set out in this guidance represents good practice.
Latest updates - 12 February 2026
12 February 2026 - this guidance was published
What do we do after we’ve finished our investigation?
Provide an outcome to the complainant
Having completed your investigation, you must let the complainant know the outcome without an unjustifiable or excessive delay.
You may be able to investigate the complaint and provide an outcome within 30 days. In these instances, you’re not required to provide an acknowledgement and outcome separately.
How you communicate with the complainant at all stages of the process is up to you, subject to any relevant equality legislation requirements. For example, you may be able to resolve more straightforward complaints quickly over the phone, provided you’ve verified the person’s identity.
You should clearly explain what you’ve done to resolve their data protection complaint and, where appropriate, any actions you’ve taken as a result. If you think that you’ve complied with data protection law, explain this in detail to the complainant. Provide enough information to help the complainant understand how you’ve reached your conclusion. It can be useful to itemise the complaint areas in a bullet point list, responding to each point and providing appropriate evidence, where possible.
If the complainant is unhappy with the outcome, you could provide more detail or clarify your decision. You could consider having a review process for complainants that remain unhappy with the outcome of their complaints.
It’s also good practice to let them know they have the right to complain to us and provide them with our contact details. There’s no obligation to do so at this stage, however, you must inform them of the right to complain at other points (eg when you first collect their personal information).
There’s no obligation for people to wait for you to review your decision before complaining to us. People can complain to us at any point.
We can only deal with complaints about data protection. If the complaint relates to another legislative or regulatory framework, we won’t be able to advise. This may mean you refer the complainant to us for data protection issues, and another service for other aspects of the same complaint.
Further reading
For more information about how people can make a complaint to us about how you’ve used their personal information, and for our contact details, see Make a complaint about how an organisation has used your personal information.
Review the lessons learned
Once you’ve provided an outcome, you should review what happened. Consider if there’s anything you can learn or improve on to prevent future complaints. Recording this information may help you identify trends or areas to improve.